PAMPOS: Causal Transformer-based Trajectory Prediction for Attack-Agnostic Misbehavior Detection in V2X Networks
Pith reviewed 2026-05-11 00:47 UTC · model grok-4.3
The pith
A causal transformer-decoder trained on benign trajectories detects unseen V2X misbehavior by flagging deviations in next-step predictions.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
PAMPOS is a causal transformer-decoder trained on benign VeReMi++ trajectories to learn normal mobility patterns. At inference time, misbehavior is identified as a deviation from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features, without requiring attack-labeled training data. Evaluation across all 19 attack types in rush-hour and afternoon scenarios yields AUC values of up to 0.98 and F1-scores of up to 0.95 for most categories.
What carries the argument
Causal transformer-decoder for next-step kinematic prediction with top-K normalized anomaly scoring to localize deviations.
If this is right
- Achieves AUC up to 0.98 and F1 up to 0.95 across 19 attack types without attack labels.
- Localizes falsification to particular kinematic features such as speed or position.
- Functions effectively in both high-density rush-hour and lower-density afternoon traffic.
- Enables detection of unseen attacks by relying solely on benign training data.
Where Pith is reading between the lines
- This approach could extend to anomaly detection in other dynamic systems like UAV swarms where only normal behavior data is available.
- The use of transformers highlights the importance of long-range temporal dependencies in modeling vehicle mobility for security.
- Testing on real-world V2X deployments would be needed to confirm performance beyond simulations.
- Combining with cryptographic methods could provide defense-in-depth against both external and insider threats.
Load-bearing premise
That deviations in predicted kinematics always indicate malicious falsification rather than legitimate but unusual driving behaviors, and that the model trained on benign data generalizes to any unseen attack.
What would settle it
Running the model on a set of normal trajectories that include rare but valid events like emergency stops and measuring if they trigger high anomaly scores.
Figures
read the original abstract
Misbehavior detection in Vehicle-to-Everything (V2X) networks is a second line of defense against insider falsification attacks that cryptographic mechanisms alone cannot address. Existing learning-based Misbehavior Detection Schemes (MDSs) are supervised, requiring labeled attack samples at training time, thus failing to counter unseen falsification attacks. We present PAMPOS, a causal transformer-decoder trained on benign VeReMi++ trajectories to learn normal mobility patterns. At inference time, misbehavior is identified as a deviation from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features, without requiring attack-labeled training data. We evaluate PAMPOS across all 19 attack types in VeReMi++ under rush-hour and afternoon scenarios, achieving Area Under the Curve (AUC) values of up to 0.98 and F1-scores of up to 0.95 for most attack categories.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces PAMPOS, a causal transformer-decoder trained exclusively on benign trajectories from the VeReMi++ dataset to model normal vehicle mobility patterns in V2X networks. Misbehavior detection is performed by identifying deviations from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that can localize the falsification to specific features. The method is evaluated on all 19 attack types in the dataset under rush-hour and afternoon scenarios, reporting AUC values up to 0.98 and F1-scores up to 0.95.
Significance. If the results hold, this work would be significant for the field of V2X security as it offers an attack-agnostic misbehavior detection scheme that does not require labeled attack data during training, addressing a major limitation of existing supervised approaches. The use of a causal transformer for trajectory prediction and the feature-localizing anomaly score represent a novel application in this domain. The comprehensive evaluation across multiple attack types and scenarios strengthens the case for practical applicability, provided the generalization to unseen benign variations is confirmed. The attack-agnostic training on benign data only is a clear strength.
major comments (2)
- [Abstract and Evaluation] The abstract and evaluation sections report strong AUC (up to 0.98) and F1 (up to 0.95) scores across 19 attacks but provide no details on model architecture depth, training hyperparameters, exact anomaly threshold selection, or statistical significance testing. These omissions are load-bearing for assessing the reliability of the central performance claims.
- [Results and Discussion] No separate false-positive evaluation is reported on held-out benign trajectories containing rare but valid maneuvers (e.g., abrupt decelerations in dense rush-hour traffic). Without this analysis, it remains unclear whether the top-K normalized anomaly scoring reliably distinguishes falsifications from legitimate distribution shifts, which directly underpins the attack-agnostic guarantee.
minor comments (2)
- [Method] The description of the top-K normalized anomaly scoring mechanism could be expanded with a precise algorithmic definition or pseudocode to improve reproducibility.
- [Abstract] Consider adding a brief note on the number of benign trajectories used for training to provide context for the reported generalization.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback. The comments highlight important aspects for strengthening reproducibility and validating the attack-agnostic claims. We address each major comment below and will incorporate revisions accordingly.
read point-by-point responses
-
Referee: [Abstract and Evaluation] The abstract and evaluation sections report strong AUC (up to 0.98) and F1 (up to 0.95) scores across 19 attacks but provide no details on model architecture depth, training hyperparameters, exact anomaly threshold selection, or statistical significance testing. These omissions are load-bearing for assessing the reliability of the central performance claims.
Authors: We agree that these implementation and evaluation details are necessary for assessing reliability and enabling reproduction. In the revised manuscript, we will expand the Methods and Evaluation sections to specify the causal transformer architecture (number of layers, attention heads, hidden dimensions, and decoder-only configuration), all training hyperparameters (learning rate schedule, batch size, number of epochs, optimizer, and regularization), the anomaly threshold selection procedure (e.g., chosen on a held-out benign validation set to target a specific false-positive rate), and statistical significance (standard deviation across multiple random seeds or runs, with confidence intervals on AUC/F1). We will also briefly reference these additions in the abstract if space permits. revision: yes
-
Referee: [Results and Discussion] No separate false-positive evaluation is reported on held-out benign trajectories containing rare but valid maneuvers (e.g., abrupt decelerations in dense rush-hour traffic). Without this analysis, it remains unclear whether the top-K normalized anomaly scoring reliably distinguishes falsifications from legitimate distribution shifts, which directly underpins the attack-agnostic guarantee.
Authors: We acknowledge the importance of explicitly demonstrating that the top-K normalized anomaly score does not flag legitimate but rare benign behaviors. While the current evaluation already computes anomaly scores on held-out benign trajectories from VeReMi++ (separate from training data) and reports low false positives overall, we did not isolate subsets with rare valid maneuvers such as abrupt decelerations. In the revision, we will add a dedicated false-positive analysis subsection that examines the distribution of anomaly scores on all held-out benign test trajectories, with particular attention to rush-hour scenarios that may contain abrupt but valid kinematic changes. This will include quantitative results showing that the scoring mechanism maintains high specificity on benign data, thereby supporting the attack-agnostic property. revision: yes
Circularity Check
No circularity: standard anomaly detection trained only on benign data
full rationale
The paper trains a causal transformer-decoder exclusively on benign VeReMi++ trajectories to learn normal mobility patterns, then flags misbehavior via deviation from next-step kinematic predictions using a top-K normalized anomaly score. This is the standard unsupervised anomaly detection setup and does not reduce any performance claim or detection rule to a quantity fitted on attack data, a self-citation chain, or a definitional tautology. No equations, derivations, or load-bearing steps in the abstract or described method exhibit self-definitional, fitted-input, or uniqueness-imported circularity. Evaluation on the 19 attack types occurs after training and is independent of the training inputs.
Axiom & Free-Parameter Ledger
Lean theorems connected to this paper
-
IndisputableMonolith/Cost/FunctionalEquation.leanwashburn_uniqueness_aczel unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
PAMPOS, a causal transformer-decoder trained on benign VeReMi++ trajectories... top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features
-
IndisputableMonolith/Foundation/AlexanderDuality.leanalexander_duality_circle_linking unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
We evaluate PAMPOS across all 19 attack types... AUC values of up to 0.98
What do these tags mean?
- matches
- The paper's claim is directly supported by a theorem in the formal canon.
- supports
- The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
- extends
- The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
- uses
- The paper appears to rely on the theorem as machinery.
- contradicts
- The paper's claim conflicts with a theorem or certificate in the canon.
- unclear
- Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.
Reference graph
Works this paper leans on
-
[1]
1609_WG - V2X Communications Working Group . 2022. IEEE Standard for Wireless Access in Vehicular Environments–Security Services for Application and Management Messages.IEEE Vehicular Technology Society(Jan. 2022)
work page 2022
-
[2]
Alladi et al. 2021. DeepADV: A Deep Neural Network Framework for Anomaly Detection in VANETs.IEEE Transactions on Vehicular Technology70, 11 (2021)
work page 2021
-
[3]
Abdelwahab Boualouache and Thomas Engel. 2023. A Survey on Machine Learning-Based Misbehavior Detection Systems for 5G and Beyond Vehicular Networks.IEEE Communications Surveys & Tutorials25, 2 (2023)
work page 2023
-
[4]
Enrique Campos, Roshan Sedar, Charalampos Kalalas, João Vinagre, and Gregorio Llano. 2025. Federated Learning for Misbehaviour Detection with Variational Autoencoders and Gaussian Mixture Models.International Journal of Information Security(2025)
work page 2025
-
[5]
Secil Ercan, Marwane Ayaida, and Nadhir Messai. 2022. Misbehavior Detection for Position Falsification Attacks in VANETs Using Machine Learning.IEEE Access10 (2022)
work page 2022
-
[6]
ETSI. 2016. Intelligent Transport Systems (ITS); Security; ITS Communications Security Architecture and Security Management
work page 2016
- [7]
-
[8]
Francesco Giuliari, Irtiza Hasan, Marco Cristani, and Fabio Galasso. 2021. Trans- former Networks for Trajectory Forecasting. In2020 25th International Conference on Pattern Recognition (ICPR). IEEE
work page 2021
-
[9]
Google. 2025.TensorFlow. https://www.tensorflow.org Accessed: Feb 2025
work page 2025
-
[10]
Sohan Gyawali, Yi Qian, and Rose Qingyang Hu. 2020. Machine Learning and Reputation Based Misbehavior Detection in Vehicular Communication Networks. IEEE Transactions on Vehicular Technology69, 8 (2020)
work page 2020
-
[11]
Hsu et al. 2022. A Deep Learning-Based Integrated Algorithm for Misbehav- ior Detection System in VANETs. InProceedings of the 2021 ACM International Conference on Intelligent Computing and its Emerging Applications
work page 2022
-
[12]
Huang et al. 2025. UltraADV: An Unsupervised Deep Learning Lightweight Framework for Anomaly Detection in V2X.IEEE Internet of Things Journal12, 9 (2025)
work page 2025
-
[13]
Konstantinos Kalogiannis, Andreas Henriksson, and Panos Papadimitratos. 2023. Vulnerability analysis of vehicular coordinated maneuvers. InIEEE EuroS&PW
work page 2023
- [14]
-
[15]
Konstantinos Kalogiannis, Mohammad Khodaei, Weaam Mostafa Nemr Mohamed Bayaa, and Panos Papadimitratos. 2022. Attack impact and misbehavior detection in vehicular platoons. InProceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks
work page 2022
-
[16]
Kamel et al. 2020. Simulation Framework for Misbehavior Detection in Vehicular Networks.IEEE Transactions on Vehicular Technology69, 6 (2020)
work page 2020
-
[17]
Kamel et al. 2020. Veremi extension: A dataset for comparable evaluation of misbehavior detection in vanets. InICC 2020-2020 IEEE International Conference on Communications (ICC). IEEE
work page 2020
-
[18]
M. Khodaei et al. 2018. SECMACE: Scalable and Robust Identity and Credential Management Infrastructure in Vehicular Communication Systems.IEEE TITS19, 5 (May 2018)
work page 2018
-
[19]
Mohammad Khodaei and Panos Papadimitratos. 2021. Scalable & Resilient Vehicle- Centric Certificate Revocation List Distribution in Vehicular Communication Systems.IEEE Transactions on Mobile Computing (IEEE TMC)20, 7 (July 2021)
work page 2021
-
[20]
Hexu Li, Konstantinos Kalogiannis, Ahmed Mohamed Hussain, and Panos Pa- padimitratos. 2025. AttentionGuard: Transformer-based Misbehavior Detection for Secure Vehicular Platoons. InProceedings of the 2025 ACM Workshop on Wireless Security and Machine Learning
work page 2025
-
[21]
Xiangyu Liu. 2022. Misbehavior Detection based on Deep Learning for VANETs. In2022 International Conference on Networks, Communications and Information Technology (CNCIT). IEEE
work page 2022
-
[22]
Zhikang Liu, Hongyun Xu, Yong Kuang, and Feng Li. 2023. Svmdformer: A semi- supervised vehicular misbehavior detection framework based on transformer in iov. In2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS). IEEE. PAMPOS: Trajectory Prediction for Attack-Agnostic Misbehavior Detection in V2X Networks WiseML ’26, June 30-J...
work page 2023
-
[23]
Panos Papadimitratos, Levente Buttyan, T. Holczer, E. Schoch, J. Freudiger, Maxim Raya, Z. Ma, Frank Kargl, A. Kung, and Jean-Pierre Hubaux. 2008. Secure Vehic- ular Communication Systems: Design and Architecture.IEEE Communications Magazine46, 11 (November 2008)
work page 2008
-
[24]
Maxim Raya, Panos Papadimitratos, Virgil Gligor, and Jean-Pierre Hubaux. 2008. On Data-Centric Trust Establishment in Ephemeral Ad hoc Networks. InIEEE Conference on Computer Communications (IEEE INFOCOM). Phoenix, AZ, USA
work page 2008
-
[25]
Rens W Van Der Heijden, Thomas Lukaseder, and Frank Kargl. 2018. Veremi: A dataset for comparable evaluation of misbehavior detection in vanets. In14th International Conference, SecureComm 2018, Singapore, Singapore, August 8-10, 2018
work page 2018
-
[26]
Vaswani et al. 2017. Attention is all you need.Advances in neural information processing systems30 (2017)
work page 2017
-
[27]
Nayera Youness, Ahmad Mostafa, Mohamed A. Sobh, Ayman M. Bahaa, and Khaled Nagaty. 2025. VeMisNet: Enhanced Feature Engineering for Deep Learning-Based Misbehavior Detection in Vehicular Ad Hoc Networks.Journal of Sensor and Actuator Networks14, 5 (2025)
work page 2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.